Miasma @withgoogle/stitch-sdk npm scope squat credential harvester via preinstall.js

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•1

Detects the execution of a malicious npm package (scope squatting on @withgoogle/stitch-sdk) that runs a preinstall script designed to harvest sensitive credentials (Claude, Git, SSH, GitHub, npm, Docker) and exfiltrate them to the domain 'stitch-production.org'.